/*
 * The contents of this file are subject to the terms 
 * of the Common Development and Distribution License 
 * (the License).  You may not use this file except in
 * compliance with the License.
 * 
 * You can obtain a copy of the license at 
 * https://glassfish.dev.java.net/public/CDDLv1.0.html or
 * glassfish/bootstrap/legal/CDDLv1.0.txt.
 * See the License for the specific language governing 
 * permissions and limitations under the License.
 * 
 * When distributing Covered Code, include this CDDL 
 * Header Notice in each file and include the License file 
 * at glassfish/bootstrap/legal/CDDLv1.0.txt.  
 * If applicable, add the following below the CDDL Header, 
 * with the fields enclosed by brackets [] replaced by
 * you own identifying information: 
 * "Portions Copyrighted [year] [name of copyright owner]"
 * 
 * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
 */

/*
 * Copyright 2004-2005 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

package com.sun.enterprise.connectors.authentication;

import com.sun.enterprise.connectors.*;
import com.sun.logging.LogDomains;
import java.security.Principal;
import java.util.logging.*;
import java.util.*;
import com.sun.enterprise.connectors.util.SecurityMapUtils;
import com.sun.enterprise.config.serverbeans.SecurityMap;
import javax.security.auth.Subject;
import javax.ejb.EJBContext;

import com.sun.enterprise.*;
import com.sun.enterprise.deployment.interfaces.*;
import com.sun.enterprise.security.factory.SecurityManagerFactory;
import com.sun.enterprise.web.*;
import com.sun.ejb.Container;


/**
  * This class does the functionality of security mapping of the 
  * principal and userGroup to the backendPrincipal. 
  * @author    Srikanth P
 */


public class BasicPasswordAuthenticationService 
              implements AuthenticationService {

    private String rarName_;
    private String poolName_;
    ConnectorRegistry connectorRegistry_ = ConnectorRegistry.getInstance();
    static Logger _logger = LogDomains.getLogger(LogDomains.RSR_LOGGER);
    private Object containerContext = null;
    
    /** 
     * Constructor 
     * @param rarName Name of the rar
     * @param poolName Name of the pool.
     */

    public BasicPasswordAuthenticationService(String rarName,String poolName) {
        rarName_  = rarName;
	poolName_ = poolName;
        _logger.log(Level.FINE,"Contructor:BasicPasswordAuthenticationService");
    }

    /**
     * Maps the principal to the backendPrincipal
     * @param principalName Name of the principal to be mapped.
     * @return Mapped Backendprincipal 
     */

    public Principal mapPrincipal(Principal callerPrincipal, Set principalSet) {
    	
    	// If no security maps are associated with this pool, return empty
        RuntimeSecurityMap runtimeSecurityMap = 
            connectorRegistry_.getRuntimeSecurityMap(poolName_);
        if(runtimeSecurityMap == null) {
            return null;
        }
        
    	String principalName = callerPrincipal.getName();
      	
    	// Create a list of Group Names from group Set
      	List<String> groupNames = new ArrayList();
      	Iterator iter = principalSet.iterator();
      	while (iter.hasNext()){
      		Principal p = (Principal)iter.next();
      		// remove the caller principal (calling user) from the Set. 
      		if (p.equals(callerPrincipal)){
      			continue;
      		}
      		String groupName = p.getName();
     		groupNames.add(groupName);      		
      	}     	
      	
        // if webmodule get roles from WebBundle Descriptor
    	if (isContainerContextAWebModuleObject()){
    	    String roleName = getRoleName(callerPrincipal);
    	    return doMap(principalName, groupNames, roleName, runtimeSecurityMap);   
    	} else {
    	    return doMap(principalName, groupNames, null, runtimeSecurityMap);
    	}
    }

    /**
     * Performs the actual mapping of the principal/userGroup to the
     * backendPrincipal by checking at the connector registry for all the
     * existing mapping. If a map is found the backendPrincipal is
     * returned else null is returned .
     */

    private Principal doMap(String principalName, List groupNames, 
    		String roleName, RuntimeSecurityMap runtimeSecurityMap) {

        // Policy: 
        // user_1, user_2, ... user_n
    	// group_1/role_1, group_2/role_2, ... group_n/role_n
        // user contains * 
    	// role/group contains *
        
        HashMap userNameSecurityMap = (HashMap)runtimeSecurityMap.getUserMap();
        HashMap groupNameSecurityMap = (HashMap)runtimeSecurityMap.getGroupMap();
              
       	// Check if caller's user-name is preset in the User Map
        if (userNameSecurityMap.containsKey(principalName)){
        	return (Principal)userNameSecurityMap.get(principalName);
        }
        
        // Check if caller's role is present in the Group Map
        if (isContainerContextAWebModuleObject() && roleName != null ){
        	if (groupNameSecurityMap.containsKey(roleName)){
        		return (Principal)groupNameSecurityMap.get(roleName);
        	}
        }
        
        // If ejb, use isCallerInRole  
        if (isContainerContextAContainerObject() && roleName == null){
        	ComponentInvocation componentInvocation = 
                Switch.getSwitch().getInvocationManager().getCurrentInvocation();
        	EJBContext ejbcontext = (EJBContext)componentInvocation.context;
        	Set s = groupNameSecurityMap.keySet();
        	Iterator i = s.iterator();
        	while (i.hasNext()){
        		String entry = (String)i.next();
          		boolean isInRole = false; 
          		try{
          			isInRole = ejbcontext.isCallerInRole(entry);
          		} catch (Exception ex){
          			_logger.log(Level.FINE,"asciPasswordAuthentication::caller not in role "+entry);
          		}
          		if (isInRole){
          			return (Principal)groupNameSecurityMap.get(entry);
          		}
        	}
        }	
        
        // Check if caller's group(s) is/are present in the Group Map
        for (int j=0; j<groupNames.size(); j++){
      		String groupName = (String)groupNames.get(j);
      		if (groupNameSecurityMap.containsKey(groupName)){
      			return (Principal)groupNameSecurityMap.get(groupName);
      		}
        }

        // Check if user name is * in Security Map
        if (userNameSecurityMap.containsKey(ConnectorConstants.SECURITYMAPMETACHAR)){
        	return (Principal)userNameSecurityMap.get(ConnectorConstants.SECURITYMAPMETACHAR);
        }

        // Check if role/group name is * in Security Map
        if (groupNameSecurityMap.containsKey(ConnectorConstants.SECURITYMAPMETACHAR)){
        	return (Principal)groupNameSecurityMap.get(ConnectorConstants.SECURITYMAPMETACHAR);
        }

        return null;
    }
    
    private String getRoleName(Principal callerPrincipal){
    
    	String roleName = null;
        WebModule _webmodule = (WebModule)getContainerContext();        	
        
        SecurityRoleMapperFactory securityRoleMapperFactory = 
                                 SecurityRoleMapperFactoryMgr.getFactory();
        SecurityRoleMapper securityRoleMapper= 
            securityRoleMapperFactory.getRoleMapper(_webmodule.getID());
               
        Map<String, Subject> map = securityRoleMapper.getRoleToSubjectMapping();
        Set<String> roleSet = map.keySet();
        Iterator iter = roleSet.iterator();
        while (iter.hasNext()){
        	roleName = (String)iter.next();
        	Subject subject = (Subject)map.get(roleName);
        	Set principalSet = subject.getPrincipals();
        	if (principalSet.contains(callerPrincipal)){
        		return roleName;
        	}        
        }
        return "";
    }
    
    //private boolean isContainerContextInstanceOfWebModule() {}
    
    private Object getContainerContext(){
    	if (this.containerContext == null){
    		ComponentInvocation componentInvocation = 
                Switch.getSwitch().getInvocationManager().getCurrentInvocation();
        	this.containerContext = componentInvocation.getContainerContext();
    	}
    	return this.containerContext;
    }
    
    private boolean isContainerContextAContainerObject(){
    	if (getContainerContext() instanceof Container){
    		return true;
    	}
    	return false;
    }
    
    private boolean isContainerContextAWebModuleObject(){
    	if (getContainerContext() instanceof WebModule){
    		return true;
    	}
    	return false;
    	
    }
}
